Re: [edk2] [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
Hi Maggie, Thanks for your contribution! Reviewed-by: Eric Dong And pushed: 8a9301cdd75439e781754014f514fa06d99140d1 Thanks, Eric > -Original Message- > From: Chu, Maggie > Sent: Wednesday, January 30, 2019 2:41 PM > To: edk2-devel@lists.01.org > Cc: Zhang, Chao B ; Yao, Jiewen > ; Dong, Eric > Subject: [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt > > https://bugzilla.tianocore.org/show_bug.cgi?id=1484 > Add a PCD for skipping password prompt and device unlock flow so that > other pre-OS applications are able to take over Opal devices unlock flow. > > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Maggie Chu > Cc: Chao Zhang > Cc: Jiewen Yao > Cc: Eric Dong > --- > SecurityPkg/SecurityPkg.dec | 6 ++ > SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c| 4 > SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++ > 3 files changed, 13 insertions(+) > > diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index > 2708e7953c..70c9ff28a8 100644 > --- a/SecurityPkg/SecurityPkg.dec > +++ b/SecurityPkg/SecurityPkg.dec > @@ -428,6 +428,12 @@ ># @Prompt Possible TPM2 Interrupt Number buffer >gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, > 0x00, 0x00}|VOID*|0x0001001D > > + ## Indicates if Opal DXE driver skip unlock device flow. > + # TRUE - Skip unlock device flow. > + # FALSE - Does not skip unlock device flow. > + # @Prompt Skip Opal DXE driver unlock device flow. > + > + > gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0 > x000 > + 10020 > + > [PcdsDynamic, PcdsDynamicEx] > >## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly > follows > TCG Algorithm Registry. diff --git > a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c > b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c > index 38268539fb..734c5f06ff 100644 > --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c > +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c > @@ -988,6 +988,10 @@ OpalDriverRequestPassword ( > > IsLocked = OpalDeviceLocked (>OpalDisk.SupportedAttributes, > >OpalDisk.LockingFeature); > > +if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) { > + return; > +} > + > while (Count < MAX_PASSWORD_TRY_COUNT) { >Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, > ); >if (PressEsc) { > diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf > b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf > index cfa55dded7..11e58b95cd 100644 > --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf > +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf > @@ -75,5 +75,8 @@ > [Guids] >gEfiEndOfDxeEventGroupGuid## CONSUMES ## > Event > > +[Pcd] > + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES > + > [Depex] >gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid > -- > 2.16.2.windows.1 ___ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel
[edk2] [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
https://bugzilla.tianocore.org/show_bug.cgi?id=1484 Add a PCD for skipping password prompt and device unlock flow so that other pre-OS applications are able to take over Opal devices unlock flow. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu Cc: Chao Zhang Cc: Jiewen Yao Cc: Eric Dong --- SecurityPkg/SecurityPkg.dec | 6 ++ SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c| 4 SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++ 3 files changed, 13 insertions(+) diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 2708e7953c..70c9ff28a8 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -428,6 +428,12 @@ # @Prompt Possible TPM2 Interrupt Number buffer gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D + ## Indicates if Opal DXE driver skip unlock device flow. + # TRUE - Skip unlock device flow. + # FALSE - Does not skip unlock device flow. + # @Prompt Skip Opal DXE driver unlock device flow. + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x00010020 + [PcdsDynamic, PcdsDynamicEx] ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry. diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c index 38268539fb..734c5f06ff 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c @@ -988,6 +988,10 @@ OpalDriverRequestPassword ( IsLocked = OpalDeviceLocked (>OpalDisk.SupportedAttributes, >OpalDisk.LockingFeature); +if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) { + return; +} + while (Count < MAX_PASSWORD_TRY_COUNT) { Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, ); if (PressEsc) { diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf index cfa55dded7..11e58b95cd 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf @@ -75,5 +75,8 @@ [Guids] gEfiEndOfDxeEventGroupGuid## CONSUMES ## Event +[Pcd] + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES + [Depex] gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid -- 2.16.2.windows.1 ___ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel
[edk2] [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
https://bugzilla.tianocore.org/show_bug.cgi?id=1484 Add a PCD for skipping password prompt and device unlock flow so that other pre-OS applications are able to take over Opal devices unlock flow. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu Cc: Chao Zhang Cc: Jiewen Yao Cc: Eric Dong --- SecurityPkg/SecurityPkg.dec | 6 ++ SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c| 4 SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++ 3 files changed, 13 insertions(+) diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 2708e7953c..05ab71ced0 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -428,6 +428,12 @@ # @Prompt Possible TPM2 Interrupt Number buffer gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D + ## Indicates if Opal DXE driver skip unlock device flow. + # TRUE - Skip unlock device flow. + # FALSE - Does not skip unlock device flow. + # @Prompt Skip Opal DXE driver unlock device flow. + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x0001001E + [PcdsDynamic, PcdsDynamicEx] ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry. diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c index 38268539fb..734c5f06ff 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c @@ -988,6 +988,10 @@ OpalDriverRequestPassword ( IsLocked = OpalDeviceLocked (>OpalDisk.SupportedAttributes, >OpalDisk.LockingFeature); +if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) { + return; +} + while (Count < MAX_PASSWORD_TRY_COUNT) { Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, ); if (PressEsc) { diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf index cfa55dded7..11e58b95cd 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf @@ -75,5 +75,8 @@ [Guids] gEfiEndOfDxeEventGroupGuid## CONSUMES ## Event +[Pcd] + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES + [Depex] gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid -- 2.16.2.windows.1 ___ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel
[edk2] [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
https://bugzilla.tianocore.org/show_bug.cgi?id=1484 Add a PCD for skipping password prompt and device unlock flow so that other pre-OS applications are able to take over Opal devices unlock flow. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu Cc: Chao Zhang Cc: Jiewen Yao Cc: Eric Dong --- SecurityPkg/SecurityPkg.dec | 6 ++ SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c| 4 SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++ 3 files changed, 13 insertions(+) diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 2708e7953c..05ab71ced0 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -428,6 +428,12 @@ # @Prompt Possible TPM2 Interrupt Number buffer gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D + ## Indicates if Opal DXE driver skip unlock device flow. + # TRUE - Skip unlock device flow. + # FALSE - Does not skip unlock device flow. + # @Prompt Skip Opal DXE driver unlock device flow. + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x0001001E + [PcdsDynamic, PcdsDynamicEx] ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry. diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c index 38268539fb..4969225b2a 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c @@ -969,6 +969,10 @@ OpalDriverRequestPassword ( TCG_RESULTRet; CHAR16*PopUpString; + if (PcdGetBool (PcdSkipOpalDxeUnlock)) { +return; + } + if (Dev == NULL) { return; } diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf index cfa55dded7..11e58b95cd 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf @@ -75,5 +75,8 @@ [Guids] gEfiEndOfDxeEventGroupGuid## CONSUMES ## Event +[Pcd] + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES + [Depex] gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid -- 2.16.2.windows.1 ___ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel